Analysis
-
max time kernel
151s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-11-2022 05:30
Static task
static1
Behavioral task
behavioral1
Sample
2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe
Resource
win7-20221111-en
General
-
Target
2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe
-
Size
1.4MB
-
MD5
48fcf3f1050b46510289f70675102a40
-
SHA1
9d532631d9b934070bc7caab50e524c52e3586dc
-
SHA256
2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e
-
SHA512
ade6c604b9df8c08f0f668538d9c7d7cabbb641d6eab29d1118c2f31a8ff26832fddd2a2e27ab76161638e9c4e32d5c6006db3e1231d0c64b029d2316dfb66f2
-
SSDEEP
24576:INmF/mnBoDM5f7F2RdcclPqVX7TwBTGQOD6N+FrFtTp3I1gRUfbVx5rLIhkp8TRu:IYVZo5TcRB1oNp4v7L81u
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
ms.exepid process 2248 ms.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 2424 takeown.exe 4620 icacls.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 2424 takeown.exe 4620 icacls.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 2 IoCs
Processes:
2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exedescription ioc process File opened for modification C:\Windows\yre.tmp 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe File opened for modification C:\WINDOWS\Bef.tmp 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exepid process 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
takeown.exedescription pid process Token: SeTakeOwnershipPrivilege 2424 takeown.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
ms.exepid process 2248 ms.exe 2248 ms.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exems.exedescription pid process target process PID 4920 wrote to memory of 2248 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe ms.exe PID 4920 wrote to memory of 2248 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe ms.exe PID 4920 wrote to memory of 2248 4920 2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe ms.exe PID 2248 wrote to memory of 2424 2248 ms.exe takeown.exe PID 2248 wrote to memory of 2424 2248 ms.exe takeown.exe PID 2248 wrote to memory of 4620 2248 ms.exe icacls.exe PID 2248 wrote to memory of 4620 2248 ms.exe icacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe"C:\Users\Admin\AppData\Local\Temp\2cdffe34c4a8bb1f41b18299d1aea771daf6aed34dc1134d502fd5e655c5464e.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ms.exeC:\Users\Admin\AppData\Local\Temp\ms.exe k2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\takeown.exetakeown /f "C:\WINDOWS\system32\Sens.dll"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\icacls.exeicacls "C:\WINDOWS\system32\Sens.dll" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ms.exeFilesize
424KB
MD5a37f6986bc775c44618b3809c558234a
SHA1725ff87dd8c8a45e03dc184545d0867c273284fa
SHA256057da3046d0a3c08b7c3da9422b1a983d3f46a4d4a6739f3c2d1e1e1cd2c8e85
SHA512d1dc31e73eff083799bfb28cd429f8365ee128ddc71ef9bd7f80b01de1b5d8088038fcfc04e2d131d6e6e0252721b5a5ac23e33bf659f8756d401b1021581ccc
-
C:\Users\Admin\AppData\Local\Temp\ms.exeFilesize
424KB
MD5a37f6986bc775c44618b3809c558234a
SHA1725ff87dd8c8a45e03dc184545d0867c273284fa
SHA256057da3046d0a3c08b7c3da9422b1a983d3f46a4d4a6739f3c2d1e1e1cd2c8e85
SHA512d1dc31e73eff083799bfb28cd429f8365ee128ddc71ef9bd7f80b01de1b5d8088038fcfc04e2d131d6e6e0252721b5a5ac23e33bf659f8756d401b1021581ccc
-
memory/2248-132-0x0000000000000000-mapping.dmp
-
memory/2424-135-0x0000000000000000-mapping.dmp
-
memory/4620-136-0x0000000000000000-mapping.dmp